CVE-2026-26964
📋 TL;DR
Windmill versions 1.634.6 and below expose Slack OAuth client secrets to non-admin users through the GET /api/w/{workspace}/workspaces/get_settings endpoint. This allows authenticated workspace members to access sensitive Slack integration credentials that should only be visible to administrators. The vulnerability affects all Windmill deployments running vulnerable versions.
💻 Affected Systems
- Windmill
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker with authenticated access could steal Slack OAuth client secrets, potentially compromising the Slack integration and enabling unauthorized access to Slack workspace data or impersonation of the Windmill application.
Likely Case
Non-admin users unintentionally gain access to Slack OAuth secrets, increasing the risk of credential exposure through accidental sharing or if user accounts are compromised.
If Mitigated
With proper access controls and monitoring, the impact is limited to credential exposure that can be rotated once discovered.
🎯 Exploit Status
Exploitation requires authenticated access to a Windmill workspace. The vulnerability is straightforward to exploit by accessing the documented API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.635.0
Vendor Advisory: https://github.com/windmill-labs/windmill/security/advisories/GHSA-f27g-j463-q85w
Restart Required: Yes
Instructions:
1. Backup your Windmill instance. 2. Update to version 1.635.0 or later using your deployment method (Docker, Kubernetes, etc.). 3. Restart the Windmill services. 4. Verify the fix by checking that non-admin users cannot access Slack OAuth secrets.
🔧 Temporary Workarounds
Restrict API endpoint access
allImplement network-level or application-level access controls to restrict non-admin users from accessing the vulnerable endpoint.
Rotate Slack OAuth credentials
allImmediately rotate any exposed Slack OAuth client secrets to prevent potential misuse.
🧯 If You Can't Patch
- Implement strict access controls to limit which users can authenticate to Windmill workspaces.
- Monitor API access logs for unauthorized attempts to access workspace settings endpoints.
🔍 How to Verify
Check if Vulnerable:
Authenticate as a non-admin user and query GET /api/w/{workspace}/workspaces/get_settings. Check if the response contains slack_oauth_client_secret field with actual values.Check Version:
Check Windmill version via web interface or API, or inspect Docker container tags if containerized.Verify Fix Applied:
After patching, repeat the vulnerable check. The slack_oauth_client_secret field should be redacted or absent for non-admin users.📡 Detection & Monitoring
Log Indicators:
- Multiple GET requests to /api/w/*/workspaces/get_settings from non-admin users
- Unusual access patterns to workspace settings endpoints
Network Indicators:
- HTTP traffic to vulnerable endpoint from unauthorized IPs or users
SIEM Query:
source="windmill" AND path="/api/w/*/workspaces/get_settings" AND user_role!="admin"